Hackers sell scans of 153,000,000 US driving licences – and drivers here could be next

The scans even included the back and front of the card (Picture: Getty/Metro) Scans of more than 153,000,000 people’s driving licences – including US Defence Secretary Pete Hegseth’s – are being sold online for £74. Tech reporter Brian Krebs discovered that Nexus, a dark web platform, was flogging a trove of American and Canadian documents on Monday. According to a post on his blog KrebsOnSecurity, the identity theft service also sold scans of: More than 10million ID cards Three million international travel cards And 579,000 medical cards, including those used to legally obtain marijuana. Another 400,000 more driving licence scans were uploaded to Nexus on Tuesday. Trying to access the site now, however, brings up an error page. The FBI launched an investigation into an apparent data breach yesterday involving the identity verification provider IDScan.net, agents told Krebs. What is going on? The dark web is a corner of the internet people can visit anonymously with special browsers and buy things using untraceable money called crypto. This is why many shady marketplaces, like Nexus, are on it. On Monday, a user shared a sample of stolen driving licences that included Krebs’ on the dark web Russian cybercrime forum Exploit. ‘We have been continuously exfiltrating new data for over a year into our private database,’ the post said. ‘Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.’ Users could pay $100 to ‘unlock’ the record and see the driver’s name, home address, date of birth and the full scan of the document. A listing for what appeared to be the redacted driving licence of Pete Hegseth (Picture: KrebsOnSecurity) Some listings included scans of the front and back of the driving licence as well as infrared and ultraviolet versions of the same images, types of light humans can’t see. Krebs found that on top of his own, the dataset included copies of his mum’s and friend’s driver’s licences. ‘I’m accustomed to having my personal and financial information published and traded by cybercriminals; that just goes with the territory, unfortunately,’ he told Metro. ‘But I feel very differently about seeing this information for sale on my friends and family. ‘It’s aggravating because a person can be doing everything right from a protect-yourself-online perspective, only to have a key personal identifier sold to anyone who wishes to buy it.’ What also worries Krebs is that sites like Nexus risk exposing people who need to stay hidden, like those fleeing domestic violence or in witness protection programmes. Users could search the database for millions of ID cards (Picture: KrebsOnSecurity) ‘The service did not redact any of the photos for licence records it had for sale, which could allow an attacker to simply scrape all of the records and conduct sophisticated face-matching comparisons to find people who do not wish to be found,’ he added. Where did all the documents come from? Krebs found that the scans all appeared to originate from IDScan.net, though it’s unclear how hackers came to possess them. The AI-powered service verifies 21million IDs every month and processes documents with infrared and ultraviolet, it said last year. IDScan.net is used by the courier FedEx, the car rental company Hertz, the video game and collectables retailer GameStop, among others, according to its website. IDScan.net has been approached for comment. A company spokesperson told Krebs it has launched an investigation into the alleged breach. A KrebsOnSecurity reader commented that IDScan.net told their business that it is investigating a ‘potential security incident’. ‘Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated,’ the message said. ‘We are working urgently to validate that information and determine whether any unauthorised access occurred, and the scope of such activity.’ Could this happen in the UK? Krebs didn’t rule out a repeat of Nexus happening in the UK. Many social media sites, forums and instant messaging services require users to prove they are 18 to access them by uploading scans or taking photos of their government-issued ID. ‘As for whether this can happen again, it absolutely can and very likely will,’Krebs said. ‘We are seeing an explosion right now in the number of online services that require visitors to prove their age or share ID to access content. ‘The more entities that collect this data, the greater the chances that malicious hackers will gain access to it as well.’ Krebs’ own driving licence was for sale (Picture: KrebsOnSecurity) Pieter Arntz, a malware intelligence researcher at the cybersecurity firm Malwarebytes, told Metro that a stolen ID scan is more worrying than a leaked password. ‘It can contain a person’s name, address, date of birth, photograph and document number – information that can support identity fraud and highly convincing social-engineering attacks,’ he said. Under the Online Safety Act, companies conducting age checks online cannot collect or store personal data unless necessary. But cybersecurity experts and free speech campaigners have long warned Metro that not every company has the resources to prevent data leaks. ‘The lesson is not that age assurance should be abandoned,’ Arntz added, ‘but that providers should collect the minimum data necessary, avoid retaining ID images where possible, and offer privacy-preserving alternatives.’ The Department of War declined to comment. FedEx, Hertz and GameStop have been approached for comment. Get in touch with our news team by emailing us at webnews@metro.co.uk. For more stories like this, check our news page. Arrow MORE: US student takes own life after being forced to wear ICE ankle monitor Arrow MORE: Lindsay Clancy’s lawyer makes stark admission about potential second trial with jury deadlocked Arrow MORE: Man, 32, dies after ‘violent attack’ at London’s Liverpool Street Station Breaking News Never miss the biggest stories with breaking news alerts in your inbox.